# Network Share Setup for Photo Uploads

Since this is a web application accessed from multiple devices, uploaded photos must be stored on a **network-accessible location** that is accessible by both:
1. The web server (Next.js application)
2. The approval system (separate project)

## ✅ Recommended: Use the Same Server as Your Database

**Simplest approach**: If your PostgreSQL database is already on a network-accessible server, store the photos on that same server's filesystem. This is the easiest setup since you already have network access to that server.

### Step 1: Create Upload Directory on Database Server

```bash
# SSH into your database server
ssh user@db-server.example.com

# Create the upload directory
sudo mkdir -p /var/punimtag/uploads/pending-photos
sudo chown -R postgres:postgres /var/punimtag/uploads
sudo chmod -R 755 /var/punimtag/uploads
```

### Step 2: Mount Database Server Directory on Web Server

Choose the method that matches your setup:

#### Option A: SSHFS (Recommended - Easiest)

If your database server is accessible via SSH (most common):

```bash
# On your web server, install SSHFS
sudo apt-get install sshfs  # Debian/Ubuntu
sudo yum install fuse-sshfs  # RHEL/CentOS

# Create mount point
sudo mkdir -p /mnt/db-server-uploads

# Mount the database server's directory
sudo sshfs user@db-server.example.com:/var/punimtag/uploads /mnt/db-server-uploads \
  -o allow_other,default_permissions

# Make it permanent (add to /etc/fstab)
# First, set up SSH key for passwordless access:
ssh-keygen -t rsa -b 4096
ssh-copy-id user@db-server.example.com

# Then add to /etc/fstab:
user@db-server.example.com:/var/punimtag/uploads /mnt/db-server-uploads fuse.sshfs allow_other,default_permissions,_netdev 0 0
```

**Benefits:**
- ✅ Uses existing SSH access (no additional setup)
- ✅ Secure (encrypted)
- ✅ Works with any database server you can SSH into
- ✅ No need for separate network share setup

#### Option B: NFS

If your database server has NFS configured:

```bash
# On database server, export the directory (if not already done)
# Add to /etc/exports:
/var/punimtag/uploads *(rw,sync,no_subtree_check)

# On web server, install NFS client
sudo apt-get install nfs-common  # Debian/Ubuntu
sudo yum install nfs-utils        # RHEL/CentOS

# Create mount point
sudo mkdir -p /mnt/db-server-uploads

# Mount the share
sudo mount -t nfs db-server.example.com:/var/punimtag/uploads /mnt/db-server-uploads

# Make it permanent (add to /etc/fstab)
db-server.example.com:/var/punimtag/uploads /mnt/db-server-uploads nfs defaults 0 0
```

#### Option C: SMB/CIFS

If your database server has SMB/CIFS configured:

```bash
# On web server, install CIFS utilities
sudo apt-get install cifs-utils  # Debian/Ubuntu
sudo yum install cifs-utils      # RHEL/CentOS

# Create mount point
sudo mkdir -p /mnt/db-server-uploads

# Mount the share
sudo mount -t cifs //db-server.example.com/uploads /mnt/db-server-uploads \
  -o username=your-username,password=your-password,uid=$(id -u),gid=$(id -g)

# Or use credentials file (more secure)
echo "username=your-username
password=your-password" | sudo tee /etc/cifs-credentials
sudo chmod 600 /etc/cifs-credentials

sudo mount -t cifs //db-server.example.com/uploads /mnt/db-server-uploads \
  -o credentials=/etc/cifs-credentials,uid=$(id -u),gid=$(id -g)

# Make it permanent (add to /etc/fstab)
//db-server.example.com/uploads /mnt/db-server-uploads cifs credentials=/etc/cifs-credentials,uid=1000,gid=1000 0 0
```

### Step 3: Configure Environment Variable

In your `.env` file:

```bash
# Required: Path to mounted database server directory
UPLOAD_DIR="/mnt/db-server-uploads/pending-photos"

# Alternative variable name (both work)
# PENDING_PHOTOS_DIR="/mnt/db-server-uploads/pending-photos"
```

### Step 4: Test Access

Test that the web server can write to the mounted directory:

```bash
# Test write access
touch /mnt/db-server-uploads/pending-photos/test-write.txt
rm /mnt/db-server-uploads/pending-photos/test-write.txt

# If successful, the mount is working correctly
```

---

## Alternative: Separate Network Share

If your database is on a managed service (e.g., AWS RDS, Google Cloud SQL) and you can't access the server filesystem, use a separate network share:

### Setup Separate Network Share

1. **Set up a network share** (SMB/CIFS, NFS, etc.) on a server accessible by both systems
2. **Mount it on your web server** using the same methods above
3. **Set `UPLOAD_DIR`** to the mounted path

Example:
```bash
# Mount separate share
sudo mount -t cifs //file-server.example.com/photos /mnt/shared-photos \
  -o credentials=/etc/cifs-credentials

# In .env
UPLOAD_DIR="/mnt/shared-photos/pending-photos"
```

---

## Directory Structure

Photos are organized by user ID:
```
/var/punimtag/uploads/pending-photos/  (on database server)
  or
/mnt/db-server-uploads/pending-photos/  (mounted on web server)
  ├── 1/                          # User ID 1
  │   ├── 1704067200000-photo1.jpg
  │   └── 1704067300000-photo2.png
  ├── 2/                          # User ID 2
  │   └── 1704067400000-photo3.jpg
  └── ...
```

## Troubleshooting

### "Upload directory not configured"
- **Solution**: Set `UPLOAD_DIR` or `PENDING_PHOTOS_DIR` in your `.env` file

### "Failed to access upload directory"
- **Check**: Network mount is active (`mount | grep db-server`)
- **Check**: Web server process has read/write permissions
- **Check**: Path is correct and absolute (not relative)
- **Test**: Try creating a file manually in the directory

### "Permission denied"
- **Solution**: Check file permissions on the database server directory
- **Solution**: Ensure mount options include correct `uid` and `gid`
- **Solution**: For SSHFS, verify SSH key authentication works

### Network mount not accessible
- **Check**: Network connectivity between servers (`ping db-server.example.com`)
- **Check**: SSH access works (`ssh user@db-server.example.com`)
- **Check**: Firewall rules allow the connection
- **Check**: Mount is active (`df -h | grep db-server`)

### SSHFS connection issues
- **Check**: SSH key is set up correctly (`ssh -v user@db-server.example.com`)
- **Check**: SSHFS is installed (`which sshfs`)
- **Check**: FUSE is enabled (`lsmod | grep fuse`)

## Security Considerations

1. **SSH Keys**: Use SSH key authentication (not passwords) for SSHFS
2. **Permissions**: Limit write access to the web server process only
3. **Network**: Use VPN or private network for database server access
4. **Backup**: Ensure database server is backed up regularly
5. **Credentials**: Store SMB/CIFS credentials securely (use credentials file)

## Integration with Approval System

The approval system should:
1. **Access the same database server** (via SSH, NFS, or SMB) to read files
2. **Query the database** for pending photos:
   ```sql
   SELECT * FROM pending_photos WHERE status = 'pending' ORDER BY submitted_at;
   ```
3. **Read files** using the `file_path` from the database:
   ```bash
   # If approval system is on same server as database
   cat /var/punimtag/uploads/pending-photos/1/1704067200000-photo1.jpg
   
   # If approval system mounts the database server
   cat /mnt/db-server-uploads/pending-photos/1/1704067200000-photo1.jpg
   ```
4. **Update status** after review:
   ```sql
   UPDATE pending_photos 
   SET status = 'approved', reviewed_at = NOW(), reviewed_by = {admin_user_id}
   WHERE id = {photo_id};
   ```

The approval system can access files directly using the `file_path` stored in the database, which points to the database server's filesystem.
